CVE-2026-103502: hex_core 0.1.0 to before 0.20.0

Affected technology

hex_core · 0.1.0 to before 0.20.0
hexpm

hex_core · fbb6d9de472e5edb8d6fb6b32a91cb266137892e to before b7b3a42defb4ed8e20a5c68a4412ce68a95b7938
hexpm

Component: hex_http_httpc
Function: hex_http_httpc:request/5, hex_http_httpc:request_to_file/6
File: src/hex_http_httpc.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality impact as high; integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.